point-to-point protocol vulnerabilities and fixes

Recent CVEs affecting point-to-point protocol, with upgrade or downgrade steps. 4 tracked.

Also searched as: point to point protocol, point-to-pointprotocol.

point-to-point protocol has 4 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2020-02-03. Highest priority: CVE-2020-8597 (score 77/100).

• CVE-2020-8597 CRITICAL 9.8 UPGRADE MITIGATE eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response
• CVE-2018-11574 CRITICAL 9.8 UPGRADE MITIGATE Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may
• CVE-2015-3310 MEDIUM 4.3 MITIGATE MITIGATE Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlie
• CVE-2014-3158 HIGH 7.5 UPGRADE Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows

FAQ

How do I fix point-to-point protocol vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is point-to-point protocol being exploited right now?

None of the tracked point-to-point protocol CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which point-to-point protocol CVE should I patch first?

CVE-2020-8597 currently ranks highest (77/100): eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response .

RSS feed for point-to-point protocol · ← Back to latest CVEs